mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-04-04 22:34:22 +02:00
25 lines
135 KiB
HTML
25 lines
135 KiB
HTML
<!doctype html>
|
|
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-7.2.x plugin-docs plugin-id-default docs-doc-id-configuration/overview" data-has-hydrated="false">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="generator" content="Docusaurus v2.4.3">
|
|
<title data-rh="true">Overview | OAuth2 Proxy</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="7.2.x"><meta data-rh="true" name="docusaurus_tag" content="docs-default-7.2.x"><meta data-rh="true" name="docsearch:version" content="7.2.x"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-7.2.x"><meta data-rh="true" property="og:title" content="Overview | OAuth2 Proxy"><meta data-rh="true" name="description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><meta data-rh="true" property="og:description" content="oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."><link data-rh="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-rh="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview" hreflang="en"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.2.x/configuration/overview" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.4014daec.css">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.797195fe.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/main.1106c429.js" as="script">
|
|
</head>
|
|
<body class="navigation-with-keyboard">
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
|
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_ToTc themedImage--light_HNdA"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" aria-haspopup="true" aria-expanded="false" role="button" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/oauth2-proxy/docs/next/configuration/overview">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/overview">7.5.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.4.x/configuration/overview">7.4.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.3.x/configuration/overview">7.3.x</a></li><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/7.2.x/configuration/overview">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/configuration/overview">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/configuration/overview">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/configuration/overview">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="Switch between dark and light mode (currently light mode)" aria-label="Switch between dark and light mode (currently light mode)" aria-live="polite"><svg viewBox="0 0 24 24" width="24" height="24" class="lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" class="darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg></button></div><div class="searchBox_ZlJk"><div class="navbar__search searchBarContainer_NW3z"><input placeholder="Search" aria-label="Search" class="navbar__search-input"><div class="loadingRing_RJI3 searchBarLoadingRing_YnHq"><div></div><div></div><div></div><div></div></div><div class="searchHintContainer_Pkmr"><kbd class="searchHint_iIMx">ctrl</kbd><kbd class="searchHint_iIMx">K</kbd></div></div></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/7.2.x/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Configuration</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="true" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Features</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="true" href="/oauth2-proxy/docs/7.2.x/community/security">Community</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/7.2.x/community/security">Security</a></li></ul></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is documentation for <!-- -->OAuth2 Proxy<!-- --> <b>7.2.x</b>, which is no longer actively maintained.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/configuration/overview">latest version</a></b> (<!-- -->7.5.x<!-- -->).</div></div><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/oauth2-proxy/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Configuration</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Overview</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: 7.2.x</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Overview</h1></header><p><code>oauth2-proxy</code> can be configured via <a href="#command-line-options">command line options</a>, <a href="#environment-variables">environment variables</a> or <a href="#config-file">config file</a> (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="generating-a-cookie-secret">Generating a Cookie Secret<a href="#generating-a-cookie-secret" class="hash-link" aria-label="Direct link to Generating a Cookie Secret" title="Direct link to Generating a Cookie Secret"></a></h3><p>To generate a strong cookie secret use one of the below commands:</p><div class="tabs-container tabList__CuJ"><ul role="tablist" aria-orientation="horizontal" class="tabs"><li role="tab" tabindex="0" aria-selected="true" class="tabs__item tabItem_LNqP tabs__item--active">Python</li><li role="tab" tabindex="-1" aria-selected="false" class="tabs__item tabItem_LNqP">Bash</li><li role="tab" tabindex="-1" aria-selected="false" class="tabs__item tabItem_LNqP">OpenSSL</li><li role="tab" tabindex="-1" aria-selected="false" class="tabs__item tabItem_LNqP">PowerShell</li><li role="tab" tabindex="-1" aria-selected="false" class="tabs__item tabItem_LNqP">Terraform</li></ul><div class="margin-top--md"><div role="tabpanel" class="tabItem_Ymn6"><div class="language-shell codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-shell codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">python -c </span><span class="token string" style="color:rgb(195, 232, 141)">'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><div role="tabpanel" class="tabItem_Ymn6" hidden=""><div class="language-shell codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-shell codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token function" style="color:rgb(130, 170, 255)">dd</span><span class="token plain"> </span><span class="token assign-left variable" style="color:rgb(191, 199, 213)">if</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">/dev/urandom </span><span class="token assign-left variable" style="color:rgb(191, 199, 213)">bs</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token number" style="color:rgb(247, 140, 108)">32</span><span class="token plain"> </span><span class="token assign-left variable" style="color:rgb(191, 199, 213)">count</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token number" style="color:rgb(247, 140, 108)">1</span><span class="token plain"> </span><span class="token operator file-descriptor important" style="color:rgb(137, 221, 255)">2</span><span class="token operator" style="color:rgb(137, 221, 255)">></span><span class="token plain">/dev/null </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> base64 </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> </span><span class="token function" style="color:rgb(130, 170, 255)">tr</span><span class="token plain"> -d -- </span><span class="token string" style="color:rgb(195, 232, 141)">'\n'</span><span class="token plain"> </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> </span><span class="token function" style="color:rgb(130, 170, 255)">tr</span><span class="token plain"> -- </span><span class="token string" style="color:rgb(195, 232, 141)">'+/'</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">'-_'</span><span class="token punctuation" style="color:rgb(199, 146, 234)">;</span><span class="token plain"> </span><span class="token builtin class-name" style="color:rgb(255, 203, 107)">echo</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><div role="tabpanel" class="tabItem_Ymn6" hidden=""><div class="language-shell codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-shell codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">openssl rand -base64 </span><span class="token number" style="color:rgb(247, 140, 108)">32</span><span class="token plain"> </span><span class="token operator" style="color:rgb(137, 221, 255)">|</span><span class="token plain"> </span><span class="token function" style="color:rgb(130, 170, 255)">tr</span><span class="token plain"> -- </span><span class="token string" style="color:rgb(195, 232, 141)">'+/'</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">'-_'</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><div role="tabpanel" class="tabItem_Ymn6" hidden=""><div class="language-shell codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-shell codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># Add System.Web assembly to session, just in case</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">Add-Type -AssemblyName System.Web</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token plain">Convert</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain">::ToBase64String</span><span class="token punctuation" style="color:rgb(199, 146, 234)">(</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token plain">System.Text.Encoding</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain">::UTF8.GetBytes</span><span class="token punctuation" style="color:rgb(199, 146, 234)">(</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token plain">System.Web.Security.Membership</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain">::GeneratePassword</span><span class="token punctuation" style="color:rgb(199, 146, 234)">(</span><span class="token number" style="color:rgb(247, 140, 108)">32,4</span><span class="token punctuation" style="color:rgb(199, 146, 234)">))</span><span class="token punctuation" style="color:rgb(199, 146, 234)">)</span><span class="token plain">.Replace</span><span class="token punctuation" style="color:rgb(199, 146, 234)">(</span><span class="token string" style="color:rgb(195, 232, 141)">"+"</span><span class="token plain">,</span><span class="token string" style="color:rgb(195, 232, 141)">"-"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">)</span><span class="token plain">.Replace</span><span class="token punctuation" style="color:rgb(199, 146, 234)">(</span><span class="token string" style="color:rgb(195, 232, 141)">"/"</span><span class="token plain">,</span><span class="token string" style="color:rgb(195, 232, 141)">"_"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">)</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div><div role="tabpanel" class="tabItem_Ymn6" hidden=""><div class="language-shell codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-shell codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">resource </span><span class="token string" style="color:rgb(195, 232, 141)">"random_password"</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"cookie_secret"</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> length </span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">32</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> override_special </span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"-_"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="config-file">Config File<a href="#config-file" class="hash-link" aria-label="Direct link to Config File" title="Direct link to Config File"></a></h3><p>Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (<!-- -->_<!-- -->). If the argument can be specified multiple times, the config option should be plural (trailing s).</p><p>An example <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example" target="_blank" rel="noopener noreferrer">oauth2-proxy.cfg</a> config file is in the contrib directory. It can be used by specifying <code>--config=/etc/oauth2-proxy.cfg</code></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="command-line-options">Command Line Options<a href="#command-line-options" class="hash-link" aria-label="Direct link to Command Line Options" title="Direct link to Command Line Options"></a></h3><table><thead><tr><th>Option</th><th>Type</th><th>Description</th><th>Default</th></tr></thead><tbody><tr><td><code>--acr-values</code></td><td>string</td><td>optional, see <a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues" target="_blank" rel="noopener noreferrer">docs</a></td><td><code>""</code></td></tr><tr><td><code>--approval-prompt</code></td><td>string</td><td>OAuth approval_prompt</td><td><code>"force"</code></td></tr><tr><td><code>--auth-logging</code></td><td>bool</td><td>Log authentication attempts</td><td>true</td></tr><tr><td><code>--auth-logging-format</code></td><td>string</td><td>Template for authentication log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--authenticated-emails-file</code></td><td>string</td><td>authenticate against emails via file (one per line)</td><td></td></tr><tr><td><code>--azure-tenant</code></td><td>string</td><td>go to a tenant-specific or common (tenant-independent) endpoint.</td><td><code>"common"</code></td></tr><tr><td><code>--basic-auth-password</code></td><td>string</td><td>the password to set when passing the HTTP Basic Auth header</td><td></td></tr><tr><td><code>--client-id</code></td><td>string</td><td>the OAuth Client ID, e.g. <code>"123456.apps.googleusercontent.com"</code></td><td></td></tr><tr><td><code>--client-secret</code></td><td>string</td><td>the OAuth Client Secret</td><td></td></tr><tr><td><code>--client-secret-file</code></td><td>string</td><td>the file with OAuth Client Secret</td><td></td></tr><tr><td><code>--config</code></td><td>string</td><td>path to config file</td><td></td></tr><tr><td><code>--cookie-domain</code></td><td>string <!-- -->|<!-- --> list</td><td>Optional cookie domains to force cookies to (e.g. <code>.yourcompany.com</code>). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).</td><td></td></tr><tr><td><code>--cookie-expire</code></td><td>duration</td><td>expire timeframe for cookie</td><td>168h0m0s</td></tr><tr><td><code>--cookie-httponly</code></td><td>bool</td><td>set HttpOnly cookie flag</td><td>true</td></tr><tr><td><code>--cookie-name</code></td><td>string</td><td>the name of the cookie that the oauth_proxy creates. Should be changed to use a <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes" target="_blank" rel="noopener noreferrer">cookie prefix</a> (<code>__Host-</code> or <code>__Secure-</code>) if <code>--cookie-secure</code> is set.</td><td><code>"_oauth2_proxy"</code></td></tr><tr><td><code>--cookie-path</code></td><td>string</td><td>an optional cookie path to force cookies to (e.g. <code>/poc/</code>)</td><td><code>"/"</code></td></tr><tr><td><code>--cookie-refresh</code></td><td>duration</td><td>refresh the cookie after this duration; <code>0</code> to disable; not supported by all providers<!-- --> <!-- -->[<a href="#footnote1">1</a>]</td><td></td></tr><tr><td><code>--cookie-secret</code></td><td>string</td><td>the seed string for secure cookies (optionally base64 encoded)</td><td></td></tr><tr><td><code>--cookie-secure</code></td><td>bool</td><td>set <a href="https://owasp.org/www-community/controls/SecureFlag" target="_blank" rel="noopener noreferrer">secure (HTTPS only) cookie flag</a></td><td>true</td></tr><tr><td><code>--cookie-samesite</code></td><td>string</td><td>set SameSite cookie attribute (<code>"lax"</code>, <code>"strict"</code>, <code>"none"</code>, or <code>""</code>).</td><td><code>""</code></td></tr><tr><td><code>--custom-templates-dir</code></td><td>string</td><td>path to custom html templates</td><td></td></tr><tr><td><code>--custom-sign-in-logo</code></td><td>string</td><td>path or a URL to an custom image for the sign_in page logo. Use \"-\" to disable default logo.</td><td></td></tr><tr><td><code>--display-htpasswd-form</code></td><td>bool</td><td>display username / password login form if an htpasswd file is provided</td><td>true</td></tr><tr><td><code>--email-domain</code></td><td>string <!-- -->|<!-- --> list</td><td>authenticate emails with the specified domain (may be given multiple times). Use <code>*</code> to authenticate any email</td><td></td></tr><tr><td><code>--errors-to-info-log</code></td><td>bool</td><td>redirects error-level logging to default log channel instead of stderr</td><td>false</td></tr><tr><td><code>--extra-jwt-issuers</code></td><td>string</td><td>if <code>--skip-jwt-bearer-tokens</code> is set, a list of extra JWT <code>issuer=audience</code> (see a token's <code>iss</code>, <code>aud</code> fields) pairs (where the issuer URL has a <code>.well-known/openid-configuration</code> or a <code>.well-known/jwks.json</code>)</td><td></td></tr><tr><td><code>--exclude-logging-path</code></td><td>string</td><td>comma separated list of paths to exclude from logging, e.g. <code>"/ping,/path2"</code></td><td><code>""</code> (no paths excluded)</td></tr><tr><td><code>--flush-interval</code></td><td>duration</td><td>period between flushing response buffers when streaming responses</td><td><code>"1s"</code></td></tr><tr><td><code>--force-https</code></td><td>bool</td><td>enforce https redirect</td><td><code>false</code></td></tr><tr><td><code>--force-json-errors</code></td><td>bool</td><td>force JSON errors instead of HTTP error pages or redirects</td><td><code>false</code></td></tr><tr><td><code>--banner</code></td><td>string</td><td>custom (html) banner string. Use <code>"-"</code> to disable default banner.</td><td></td></tr><tr><td><code>--footer</code></td><td>string</td><td>custom (html) footer string. Use <code>"-"</code> to disable default footer.</td><td></td></tr><tr><td><code>--github-org</code></td><td>string</td><td>restrict logins to members of this organisation</td><td></td></tr><tr><td><code>--github-team</code></td><td>string</td><td>restrict logins to members of any of these teams (slug), separated by a comma</td><td></td></tr><tr><td><code>--github-repo</code></td><td>string</td><td>restrict logins to collaborators of this repository formatted as <code>orgname/repo</code></td><td></td></tr><tr><td><code>--github-token</code></td><td>string</td><td>the token to use when verifying repository collaborators (must have push access to the repository)</td><td></td></tr><tr><td><code>--github-user</code></td><td>string <!-- -->|<!-- --> list</td><td>To allow users to login by username even if they do not belong to the specified org and team or collaborators</td><td></td></tr><tr><td><code>--gitlab-group</code></td><td>string <!-- -->|<!-- --> list</td><td>restrict logins to members of any of these groups (slug), separated by a comma</td><td></td></tr><tr><td><code>--gitlab-projects</code></td><td>string <!-- -->|<!-- --> list</td><td>restrict logins to members of any of these projects (may be given multiple times) formatted as <code>orgname/repo=accesslevel</code>. Access level should be a value matching <a href="https://docs.gitlab.com/ee/api/members.html#valid-access-levels" target="_blank" rel="noopener noreferrer">Gitlab access levels</a>, defaulted to 20 if absent</td><td></td></tr><tr><td><code>--google-admin-email</code></td><td>string</td><td>the google admin to impersonate for api calls</td><td></td></tr><tr><td><code>--google-group</code></td><td>string</td><td>restrict logins to members of this google group (may be given multiple times).</td><td></td></tr><tr><td><code>--google-service-account-json</code></td><td>string</td><td>the path to the service account json credentials</td><td></td></tr><tr><td><code>--htpasswd-file</code></td><td>string</td><td>additionally authenticate against a htpasswd file. Entries must be created with <code>htpasswd -B</code> for bcrypt encryption</td><td></td></tr><tr><td><code>--htpasswd-user-group</code></td><td>string <!-- -->|<!-- --> list</td><td>the groups to be set on sessions for htpasswd users</td><td></td></tr><tr><td><code>--http-address</code></td><td>string</td><td><code>[http://]<addr>:<port></code> or <code>unix://<path></code> to listen on for HTTP clients</td><td><code>"127.0.0.1:4180"</code></td></tr><tr><td><code>--https-address</code></td><td>string</td><td><code><addr>:<port></code> to listen on for HTTPS clients</td><td><code>":443"</code></td></tr><tr><td><code>--logging-compress</code></td><td>bool</td><td>Should rotated log files be compressed using gzip</td><td>false</td></tr><tr><td><code>--logging-filename</code></td><td>string</td><td>File to log requests to, empty for <code>stdout</code></td><td><code>""</code> (stdout)</td></tr><tr><td><code>--logging-local-time</code></td><td>bool</td><td>Use local time in log files and backup filenames instead of UTC</td><td>true (local time)</td></tr><tr><td><code>--logging-max-age</code></td><td>int</td><td>Maximum number of days to retain old log files</td><td>7</td></tr><tr><td><code>--logging-max-backups</code></td><td>int</td><td>Maximum number of old log files to retain; 0 to disable</td><td>0</td></tr><tr><td><code>--logging-max-size</code></td><td>int</td><td>Maximum size in megabytes of the log file before rotation</td><td>100</td></tr><tr><td><code>--jwt-key</code></td><td>string</td><td>private key in PEM format used to sign JWT, so that you can say something like <code>--jwt-key="${OAUTH2_PROXY_JWT_KEY}"</code>: required by login.gov</td><td></td></tr><tr><td><code>--jwt-key-file</code></td><td>string</td><td>path to the private key file in PEM format used to sign the JWT so that you can say something like <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code>: required by login.gov</td><td></td></tr><tr><td><code>--login-url</code></td><td>string</td><td>Authentication endpoint</td><td></td></tr><tr><td><code>--insecure-oidc-allow-unverified-email</code></td><td>bool</td><td>don't fail if an email address in an id_token is not verified</td><td>false</td></tr><tr><td><code>--insecure-oidc-skip-issuer-verification</code></td><td>bool</td><td>allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)</td><td>false</td></tr><tr><td><code>--insecure-oidc-skip-nonce</code></td><td>bool</td><td>skip verifying the OIDC ID Token's nonce claim</td><td>true</td></tr><tr><td><code>--oidc-issuer-url</code></td><td>string</td><td>the OpenID Connect issuer URL, e.g. <code>"https://accounts.google.com"</code></td><td></td></tr><tr><td><code>--oidc-jwks-url</code></td><td>string</td><td>OIDC JWKS URI for token verification; required if OIDC discovery is disabled</td><td></td></tr><tr><td><code>--oidc-email-claim</code></td><td>string</td><td>which OIDC claim contains the user's email</td><td><code>"email"</code></td></tr><tr><td><code>--oidc-groups-claim</code></td><td>string</td><td>which OIDC claim contains the user groups</td><td><code>"groups"</code></td></tr><tr><td><code>--pass-access-token</code></td><td>bool</td><td>pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with <code>--set-xauthrequest</code> this adds the X-Auth-Request-Access-Token header to the response</td><td>false</td></tr><tr><td><code>--pass-authorization-header</code></td><td>bool</td><td>pass OIDC IDToken to upstream via Authorization Bearer header</td><td>false</td></tr><tr><td><code>--pass-basic-auth</code></td><td>bool</td><td>pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--prefer-email-to-user</code></td><td>bool</td><td>Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with <code>--pass-basic-auth</code> and <code>--pass-user-headers</code></td><td>false</td></tr><tr><td><code>--pass-host-header</code></td><td>bool</td><td>pass the request Host Header to upstream</td><td>true</td></tr><tr><td><code>--pass-user-headers</code></td><td>bool</td><td>pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream</td><td>true</td></tr><tr><td><code>--profile-url</code></td><td>string</td><td>Profile access endpoint</td><td></td></tr><tr><td><code>--prompt</code></td><td>string</td><td><a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" target="_blank" rel="noopener noreferrer">OIDC prompt</a>; if present, <code>approval-prompt</code> is ignored</td><td><code>""</code></td></tr><tr><td><code>--provider</code></td><td>string</td><td>OAuth provider</td><td>google</td></tr><tr><td><code>--provider-ca-file</code></td><td>string <!-- -->|<!-- --> list</td><td>Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead.</td><td></td></tr><tr><td><code>--provider-display-name</code></td><td>string</td><td>Override the provider's name with the given string; used for the sign-in page</td><td>(depends on provider)</td></tr><tr><td><code>--ping-path</code></td><td>string</td><td>the ping endpoint that can be used for basic health checks</td><td><code>"/ping"</code></td></tr><tr><td><code>--ping-user-agent</code></td><td>string</td><td>a User-Agent that can be used for basic health checks</td><td><code>""</code> (don't check user agent)</td></tr><tr><td><code>--metrics-address</code></td><td>string</td><td>the address prometheus metrics will be scraped from</td><td><code>""</code></td></tr><tr><td><code>--proxy-prefix</code></td><td>string</td><td>the url root path that this proxy should be nested under (e.g. /<code><oauth2>/sign_in</code>)</td><td><code>"/oauth2"</code></td></tr><tr><td><code>--proxy-websockets</code></td><td>bool</td><td>enables WebSocket proxying</td><td>true</td></tr><tr><td><code>--pubjwk-url</code></td><td>string</td><td>JWK pubkey access endpoint: required by login.gov</td><td></td></tr><tr><td><code>--real-client-ip-header</code></td><td>string</td><td>Header used to determine the real IP of the client, requires <code>--reverse-proxy</code> to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)</td><td>X-Real-IP</td></tr><tr><td><code>--redeem-url</code></td><td>string</td><td>Token redemption endpoint</td><td></td></tr><tr><td><code>--redirect-url</code></td><td>string</td><td>the OAuth Redirect URL, e.g. <code>"https://internalapp.yourcompany.com/oauth2/callback"</code></td><td></td></tr><tr><td><code>--redis-cluster-connection-urls</code></td><td>string <!-- -->|<!-- --> list</td><td>List of Redis cluster connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-cluster</code></td><td></td></tr><tr><td><code>--redis-connection-url</code></td><td>string</td><td>URL of redis server for redis session storage (e.g. <code>redis://HOST[:PORT]</code>)</td><td></td></tr><tr><td><code>--redis-password</code></td><td>string</td><td>Redis password. Applicable for all Redis configurations. Will override any password set in <code>--redis-connection-url</code></td><td></td></tr><tr><td><code>--redis-sentinel-password</code></td><td>string</td><td>Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use <code>--redis-password</code></td><td></td></tr><tr><td><code>--redis-sentinel-master-name</code></td><td>string</td><td>Redis sentinel master name. Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-sentinel-connection-urls</code></td><td>string <!-- -->|<!-- --> list</td><td>List of Redis sentinel connection URLs (e.g. <code>redis://HOST[:PORT]</code>). Used in conjunction with <code>--redis-use-sentinel</code></td><td></td></tr><tr><td><code>--redis-use-cluster</code></td><td>bool</td><td>Connect to redis cluster. Must set <code>--redis-cluster-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--redis-use-sentinel</code></td><td>bool</td><td>Connect to redis via sentinels. Must set <code>--redis-sentinel-master-name</code> and <code>--redis-sentinel-connection-urls</code> to use this feature</td><td>false</td></tr><tr><td><code>--request-id-header</code></td><td>string</td><td>Request header to use as the request ID in logging</td><td>X-Request-Id</td></tr><tr><td><code>--request-logging</code></td><td>bool</td><td>Log requests</td><td>true</td></tr><tr><td><code>--request-logging-format</code></td><td>string</td><td>Template for request log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--resource</code></td><td>string</td><td>The resource that is protected (Azure AD only)</td><td></td></tr><tr><td><code>--reverse-proxy</code></td><td>bool</td><td>are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection</td><td>false</td></tr><tr><td><code>--scope</code></td><td>string</td><td>OAuth scope specification</td><td></td></tr><tr><td><code>--session-cookie-minimal</code></td><td>bool</td><td>strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)</td><td>false</td></tr><tr><td><code>--session-store-type</code></td><td>string</td><td><a href="/oauth2-proxy/docs/7.2.x/configuration/session_storage">Session data storage backend</a>; redis or cookie</td><td>cookie</td></tr><tr><td><code>--set-xauthrequest</code></td><td>bool</td><td>set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with <code>--pass-access-token</code>, X-Auth-Request-Access-Token is added to response headers.</td><td>false</td></tr><tr><td><code>--set-authorization-header</code></td><td>bool</td><td>set Authorization Bearer response header (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--set-basic-auth</code></td><td>bool</td><td>set HTTP Basic Auth information in response (useful in Nginx auth_request mode)</td><td>false</td></tr><tr><td><code>--show-debug-on-error</code></td><td>bool</td><td>show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)</td><td>false</td></tr><tr><td><code>--signature-key</code></td><td>string</td><td>GAP-Signature request signature key (algorithm:secretkey)</td><td></td></tr><tr><td><code>--silence-ping-logging</code></td><td>bool</td><td>disable logging of requests to ping endpoint</td><td>false</td></tr><tr><td><code>--skip-auth-preflight</code></td><td>bool</td><td>will skip authentication for OPTIONS requests</td><td>false</td></tr><tr><td><code>--skip-auth-regex</code></td><td>string <!-- -->|<!-- --> list</td><td>(DEPRECATED for <code>--skip-auth-route</code>) bypass authentication for requests paths that match (may be given multiple times)</td><td></td></tr><tr><td><code>--skip-auth-route</code></td><td>string <!-- -->|<!-- --> list</td><td>bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods</td><td></td></tr><tr><td><code>--skip-auth-strip-headers</code></td><td>bool</td><td>strips <code>X-Forwarded-*</code> style authentication headers & <code>Authorization</code> header if they would be set by oauth2-proxy</td><td>true</td></tr><tr><td><code>--skip-jwt-bearer-tokens</code></td><td>bool</td><td>will skip requests that have verified JWT bearer tokens (the token must have <a href="https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields" target="_blank" rel="noopener noreferrer"><code>aud</code></a> that matches this client id or one of the extras from <code>extra-jwt-issuers</code>)</td><td>false</td></tr><tr><td><code>--skip-oidc-discovery</code></td><td>bool</td><td>bypass OIDC endpoint discovery. <code>--login-url</code>, <code>--redeem-url</code> and <code>--oidc-jwks-url</code> must be configured in this case</td><td>false</td></tr><tr><td><code>--skip-provider-button</code></td><td>bool</td><td>will skip sign-in-page to directly reach the next step: oauth/start</td><td>false</td></tr><tr><td><code>--ssl-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS providers</td><td>false</td></tr><tr><td><code>--ssl-upstream-insecure-skip-verify</code></td><td>bool</td><td>skip validation of certificates presented when using HTTPS upstreams</td><td>false</td></tr><tr><td><code>--standard-logging</code></td><td>bool</td><td>Log standard runtime information</td><td>true</td></tr><tr><td><code>--standard-logging-format</code></td><td>string</td><td>Template for standard log lines</td><td>see <a href="#logging-configuration">Logging Configuration</a></td></tr><tr><td><code>--tls-cert-file</code></td><td>string</td><td>path to certificate file</td><td></td></tr><tr><td><code>--tls-key-file</code></td><td>string</td><td>path to private key file</td><td></td></tr><tr><td><code>--upstream</code></td><td>string <!-- -->|<!-- --> list</td><td>the http url(s) of the upstream endpoint, file:// paths for static files or <code>static://<status_code></code> for static response. Routing is based on the path</td><td></td></tr><tr><td><code>--allowed-group</code></td><td>string <!-- -->|<!-- --> list</td><td>restrict logins to members of this group (may be given multiple times)</td><td></td></tr><tr><td><code>--allowed-role</code></td><td>string <!-- -->|<!-- --> list</td><td>restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider.</td><td></td></tr><tr><td><code>--validate-url</code></td><td>string</td><td>Access token validation endpoint</td><td></td></tr><tr><td><code>--version</code></td><td>n/a</td><td>print version string</td><td></td></tr><tr><td><code>--whitelist-domain</code></td><td>string <!-- -->|<!-- --> list</td><td>allowed domains for redirection after authentication. Prefix domain with a <code>.</code> to allow subdomains (e.g. <code>.example.com</code>)<!-- --> <!-- -->[<a href="#footnote2">2</a>]</td><td></td></tr><tr><td><code>--trusted-ip</code></td><td>string <!-- -->|<!-- --> list</td><td>list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with <code>--reverse-proxy</code> and optionally <code>--real-client-ip-header</code> this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them.</td><td></td></tr></tbody></table><p>[<a name="footnote1">1</a>]<!-- -->: Only these providers support <code>--cookie-refresh</code>: GitLab, Google and OIDC</p><p>[<a name="footnote2">2</a>]<!-- -->: When using the <code>whitelist-domain</code> option, any domain prefixed with a <code>.</code> will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: <code>example.com:8080</code>. To allow any port, use <code>*</code>: <code>example.com:*</code>.</p><p>See below for provider specific options</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="upstreams-configuration">Upstreams Configuration<a href="#upstreams-configuration" class="hash-link" aria-label="Direct link to Upstreams Configuration" title="Direct link to Upstreams Configuration"></a></h3><p><code>oauth2-proxy</code> supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as <code>http://127.0.0.1:8080/</code> for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide <code>http://127.0.0.1:8080/some/path/</code> then it will only be requests that start with <code>/some/path/</code> which are forwarded to the upstream.</p><p>Static file paths are configured as a file:// URL. <code>file:///var/www/static/</code> will serve the files from that directory at <code>http://[oauth2-proxy url]/var/www/static/</code>, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. <code>file:///var/www/static/#/static/</code> will make <code>/var/www/static/</code> available at <code>http://[oauth2-proxy url]/static/</code>.</p><p>Multiple upstreams can either be configured by supplying a comma separated list to the <code>--upstream</code> parameter, supplying the parameter multiple times or providing a list in the <a href="#config-file">config file</a>. When multiple upstreams are used routing to them will be based on the path they are set up with.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="environment-variables">Environment variables<a href="#environment-variables" class="hash-link" aria-label="Direct link to Environment variables" title="Direct link to Environment variables"></a></h3><p>Every command line argument can be specified as an environment variable by
|
|
prefixing it with <code>OAUTH2_PROXY_</code>, capitalising it, and replacing hyphens (<code>-</code>)
|
|
with underscores (<code>_</code>). If the argument can be specified multiple times, the
|
|
environment variable should be plural (trailing <code>S</code>).</p><p>This is particularly useful for storing secrets outside of a configuration file
|
|
or the command line.</p><p>For example, the <code>--cookie-secret</code> flag becomes <code>OAUTH2_PROXY_COOKIE_SECRET</code>,
|
|
and the <code>--email-domain</code> flag becomes <code>OAUTH2_PROXY_EMAIL_DOMAINS</code>.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="logging-configuration">Logging Configuration<a href="#logging-configuration" class="hash-link" aria-label="Direct link to Logging Configuration" title="Direct link to Logging Configuration"></a></h2><p>By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the <code>--logging-filename</code> command.</p><p>If logging to a file you can also configure the maximum file size (<code>--logging-max-size</code>), age (<code>--logging-max-age</code>), max backup logs (<code>--logging-max-backups</code>), and if backup logs should be compressed (<code>--logging-compress</code>).</p><p>There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with <code>--standard-logging</code>, <code>--auth-logging</code>, and <code>--request-logging</code>.</p><p>Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.</p><p>Logging of requests to the <code>/ping</code> endpoint (or using <code>--ping-user-agent</code>) can be disabled with <code>--silence-ping-logging</code> reducing log volume. This flag appends the <code>--ping-path</code> to <code>--exclude-logging-paths</code>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="auth-log-format">Auth Log Format<a href="#auth-log-format" class="hash-link" aria-label="Direct link to Auth Log Format" title="Direct link to Auth Log Format"></a></h3><p>Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain"><REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>The status block will contain one of the below strings:</p><ul><li><code>AuthSuccess</code> If a user has authenticated successfully by any method</li><li><code>AuthFailure</code> If the user failed to authenticate explicitly</li><li><code>AuthError</code> If there was an unexpected error during authentication</li></ul><p>If you require a different format than that, you can configure it with the <code>--auth-logging-format</code> flag.
|
|
The default format is configured as follows:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Available variables for auth logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Message</td><td>Authenticated via OAuth2</td><td>The details of the auth attempt.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr><tr><td>Status</td><td>AuthSuccess</td><td>The status of the auth request. See above for details.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_LWe7" id="request-log-format">Request Log Format<a href="#request-log-format" class="hash-link" aria-label="Direct link to Request Log Format" title="Direct link to Request Log Format"></a></h3><p>HTTP request logs will output by default in the below format:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain"><REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>If you require a different format than that, you can configure it with the <code>--request-logging-format</code> flag.
|
|
The default format is configured as follows:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Available variables for request logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Client</td><td>74.125.224.72</td><td>The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.</td></tr><tr><td>Host</td><td>domain.com</td><td>The value of the Host header.</td></tr><tr><td>Protocol</td><td>HTTP/1.0</td><td>The request protocol.</td></tr><tr><td>RequestDuration</td><td>0.001</td><td>The time in seconds that a request took to process.</td></tr><tr><td>RequestID</td><td>00010203-0405-4607-8809-0a0b0c0d0e0f</td><td>The request ID pulled from the <code>--request-id-header</code>. Random UUID if empty</td></tr><tr><td>RequestMethod</td><td>GET</td><td>The request method.</td></tr><tr><td>RequestURI</td><td>"/oauth2/auth"</td><td>The URI path of the request.</td></tr><tr><td>ResponseSize</td><td>12</td><td>The size in bytes of the response.</td></tr><tr><td>StatusCode</td><td>200</td><td>The HTTP status code of the response.</td></tr><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>Upstream</td><td>-</td><td>The upstream data of the HTTP request.</td></tr><tr><td>UserAgent</td><td>-</td><td>The full user agent as reported by the requesting client.</td></tr><tr><td>Username</td><td><a href="mailto:username@email.com" target="_blank" rel="noopener noreferrer">username@email.com</a></td><td>The email or username of the auth request.</td></tr></tbody></table><h3 class="anchor anchorWithStickyNavbar_LWe7" id="standard-log-format">Standard Log Format<a href="#standard-log-format" class="hash-link" aria-label="Direct link to Standard Log Format" title="Direct link to Standard Log Format"></a></h3><p>All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE></span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>If you require a different format than that, you can configure it with the <code>--standard-logging-format</code> flag. The default format is configured as follows:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">[{{.Timestamp}}] [{{.File}}] {{.Message}}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>Available variables for standard logging:</p><table><thead><tr><th>Variable</th><th>Example</th><th>Description</th></tr></thead><tbody><tr><td>Timestamp</td><td>19/Mar/2015:17:20:19 -0400</td><td>The date and time of the logging event.</td></tr><tr><td>File</td><td>main.go:40</td><td>The file and line number of the logging statement.</td></tr><tr><td>Message</td><td>HTTP: listening on 127.0.0.1:4180</td><td>The details of the log statement.</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_LWe7" id="configuring-for-use-with-the-nginx-auth_request-directive">Configuring for use with the Nginx <code>auth_request</code> directive<a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="hash-link" aria-label="Direct link to configuring-for-use-with-the-nginx-auth_request-directive" title="Direct link to configuring-for-use-with-the-nginx-auth_request-directive"></a></h2><p>The <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" target="_blank" rel="noopener noreferrer">Nginx <code>auth_request</code> directive</a> allows Nginx to authenticate requests via the oauth2-proxy's <code>/auth</code> endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:</p><div class="language-nginx codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-nginx codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">server {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> listen 443 ssl;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> server_name ...;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> include ssl/ssl.conf;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location /oauth2/ {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Auth-Request-Redirect $request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or, if you are handling multiple domains:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location = /oauth2/auth {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://127.0.0.1:4180;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Host $host;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Real-IP $remote_addr;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Scheme $scheme;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # nginx auth_request includes headers but not body</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header Content-Length "";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass_request_body off;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> location / {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request /oauth2/auth;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> error_page 401 = /oauth2/sign_in;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # pass information via X-User and X-Email headers to backend,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # requires running with --set-xauthrequest flag</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $user $upstream_http_x_auth_request_user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $email $upstream_http_x_auth_request_email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-User $user;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Email $email;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --pass-access-token, this will pass the token to the backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $token $upstream_http_x_auth_request_access_token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_set_header X-Access-Token $token;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # if you enabled --cookie-refresh, this is needed for it to work with auth_request</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie $upstream_http_set_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # limit and so the OAuth2 Proxy splits these into multiple parts.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Extract the Cookie attributes from the first Set-Cookie header and append them</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # to the second part ($upstream_cookie_* variables only contain the raw cookie content)</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie ~* "(; .*)") {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_0 $auth_cookie;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # Send both Set-Cookie headers now if there was a second part</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ($auth_cookie_name_upstream_1) {</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_0;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> add_header Set-Cookie $auth_cookie_name_1;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> proxy_pass http://backend/;</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> # or "root /path/to/site;" or "fastcgi_pass ..." etc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>When you use ingress-nginx in Kubernetes, you MUST use <code>kubernetes/ingress-nginx</code> (which includes the Lua module) and the following configuration snippet for your <code>Ingress</code>.
|
|
Variables set with <code>auth_request_set</code> are not <code>set</code>-able in plain nginx config when the location is processed via <code>proxy_pass</code> and then may only be processed by Lua.
|
|
Note that <code>nginxinc/kubernetes-ingress</code> does not include the Lua module.</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">nginx.ingress.kubernetes.io/auth-response-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-signin</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/start</span><span class="token punctuation" style="color:rgb(199, 146, 234)">?</span><span class="token plain">rd=$escaped_request_uri</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/auth-url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//$host/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">|</span><span class="token scalar string" style="color:rgb(195, 232, 141)"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token scalar string" style="color:rgb(195, 232, 141)"> auth_request_set $name_upstream_1 $upstream_cookie_name_1;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> access_by_lua_block </span><span class="token punctuation" style="color:rgb(199, 146, 234)">{</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> if ngx.var.name_upstream_1 ~= "" then</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> ngx.header</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token string" style="color:rgb(195, 232, 141)">"Set-Cookie"</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"> = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">match("(; .</span><span class="token important">*)")</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> end</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>It is recommended to use <code>--session-store-type=redis</code> when expecting large sessions/OIDC tokens (<em>e.g.</em> with MS Azure).</p><p>You have to substitute <em>name</em> with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="configuring-for-use-with-the-traefik-v2-forwardauth-middleware">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware<a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="hash-link" aria-label="Direct link to configuring-for-use-with-the-traefik-v2-forwardauth-middleware" title="Direct link to configuring-for-use-with-the-traefik-v2-forwardauth-middleware"></a></h2><p><strong>This option requires <code>--reverse-proxy</code> option to be set.</strong></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="forwardauth-with-401-errors-middleware">ForwardAuth with 401 errors middleware<a href="#forwardauth-with-401-errors-middleware" class="hash-link" aria-label="Direct link to ForwardAuth with 401 errors middleware" title="Direct link to ForwardAuth with 401 errors middleware"></a></h3><p>The <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> allows Traefik to authenticate requests via the oauth2-proxy's <code>/oauth2/auth</code> endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">errors</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">errors</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">status</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"401-403"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">query</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"/oauth2/sign_in"</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="forwardauth-with-static-upstreams-configuration">ForwardAuth with static upstreams configuration<a href="#forwardauth-with-static-upstreams-configuration" class="hash-link" aria-label="Direct link to ForwardAuth with static upstreams configuration" title="Direct link to ForwardAuth with static upstreams configuration"></a></h3><p>Redirect to sign_in functionality provided without the use of <code>errors</code> middleware with <a href="https://doc.traefik.io/traefik/middlewares/forwardauth/" target="_blank" rel="noopener noreferrer">Traefik v2 <code>ForwardAuth</code> middleware</a> pointing to oauth2-proxy service's <code>/</code> endpoint</p><p><strong>Following options need to be set on <code>oauth2-proxy</code>:</strong></p><ul><li><code>--upstream=static://202</code>: Configures a static response for authenticated sessions</li><li><code>--reverse-proxy=true</code>: Enables the use of <code>X-Forwarded-*</code> headers to determine redirects correctly</li></ul><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token key atrule">http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">routers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># redirects all unauthenticated to oauth2 signin</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-route-2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> a</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">wo</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">redirect </span><span class="token comment" style="color:rgb(105, 112, 152);font-style:italic"># unauthenticated session will return a 401</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services-oauth2-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth2-proxy-route</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">rule</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"Host(`oauth.example.com`) && PathPrefix(`/`)"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">headers</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">service</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> oauth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">backend</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">tls</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">certResolver</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> default</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">domains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">main</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sans</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token string" style="color:rgb(195, 232, 141)">"*.example.com"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">services</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">a-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.2</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">b-service-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.3</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">7555</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-backend</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">loadBalancer</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">servers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//172.16.0.1</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token number" style="color:rgb(247, 140, 108)">4180</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">middlewares</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">auth-headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">headers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslRedirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsSeconds</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token number" style="color:rgb(247, 140, 108)">315360000</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">browserXssFilter</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">contentTypeNosniff</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forceSTSHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">sslHost</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> example.com</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsIncludeSubdomains</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">stsPreload</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">frameDeny</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">oauth-auth-wo-redirect</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">forwardAuth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">address</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> https</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain">//oauth.example.com/oauth2/auth</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">trustForwardHeader</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> </span><span class="token boolean important" style="color:rgb(255, 88, 116)">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">authResponseHeaders</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> X</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Auth</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Request</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Access</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">Token</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> Authorization</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><div class="theme-admonition theme-admonition-note alert alert--secondary admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 14 16"><path fill-rule="evenodd" d="M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"></path></svg></span>note</div><div class="admonitionContent_S0QG"><p>If you set up your OAuth2 provider to rotate your client secret, you can use the <code>client-secret-file</code> option to reload the secret when it is updated.</p></div></div></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/overview.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/oauth2-proxy/docs/7.2.x/behaviour"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Behaviour</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/oauth2-proxy/docs/7.2.x/configuration/oauth_provider"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#generating-a-cookie-secret" class="table-of-contents__link toc-highlight">Generating a Cookie Secret</a></li><li><a href="#config-file" class="table-of-contents__link toc-highlight">Config File</a></li><li><a href="#command-line-options" class="table-of-contents__link toc-highlight">Command Line Options</a></li><li><a href="#upstreams-configuration" class="table-of-contents__link toc-highlight">Upstreams Configuration</a></li><li><a href="#environment-variables" class="table-of-contents__link toc-highlight">Environment variables</a></li><li><a href="#logging-configuration" class="table-of-contents__link toc-highlight">Logging Configuration</a><ul><li><a href="#auth-log-format" class="table-of-contents__link toc-highlight">Auth Log Format</a></li><li><a href="#request-log-format" class="table-of-contents__link toc-highlight">Request Log Format</a></li><li><a href="#standard-log-format" class="table-of-contents__link toc-highlight">Standard Log Format</a></li></ul></li><li><a href="#configuring-for-use-with-the-nginx-auth_request-directive" class="table-of-contents__link toc-highlight">Configuring for use with the Nginx <code>auth_request</code> directive</a></li><li><a href="#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" class="table-of-contents__link toc-highlight">Configuring for use with the Traefik (v2) <code>ForwardAuth</code> middleware</a><ul><li><a href="#forwardauth-with-401-errors-middleware" class="table-of-contents__link toc-highlight">ForwardAuth with 401 errors middleware</a></li><li><a href="#forwardauth-with-static-upstreams-configuration" class="table-of-contents__link toc-highlight">ForwardAuth with static upstreams configuration</a></li></ul></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2024 OAuth2 Proxy.</div></div></div></footer></div>
|
|
<script src="/oauth2-proxy/assets/js/runtime~main.797195fe.js"></script>
|
|
<script src="/oauth2-proxy/assets/js/main.1106c429.js"></script>
|
|
</body>
|
|
</html> |